Techniques for detecting cloud identity misuse leveraging runtime context

Abstract

A system and method for detecting cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; continuously receiving data from the runtime sensor; generating an activity baseline based on the continuously received data, wherein the runtime sensor is configured to detect runtime processes on the workload; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; and determining that the event is an anomalous event based on the generated activity baseline.

What is claimed is: 
     
         1 . A method for detecting cloud identity misuse in a cloud computing environment, comprising:
 deploying a runtime sensor on a workload in a cloud computing environment;   receiving event data from the runtime sensor;   detecting an identifier of a runtime process in the received event data;   generating an activity baseline for the runtime process based at least on the received event data, wherein the runtime sensor is configured to detect a plurality of runtime process identifiers on the workload;   detecting an event in a cloud log, the event including an identifier of the workload;   associating the runtime process detected by the runtime sensor on the workload with the event detected in the cloud log based at least on the identifier of the workload; and   determining that the event detected in the cloud log is an anomalous event based on the generated activity baseline of the runtime process.   
     
     
         2 . The method of  claim 1 , further comprising:
 detecting a code object utilized to deploy the workload in the cloud computing environment;   inspecting the code object for a cybersecurity object, wherein the cybersecurity object indicates an identity utilized by the workload;   associating the runtime process with the event based on an identifier of the workload and the indicated identity.   
     
     
         3 . The method of  claim 1 , further comprising:
 generating the activity baseline based on a plurality of events detected in the received event data.   
     
     
         4 . The method of  claim 3 , further comprising:
 generating the activity baseline based only on a group of events of the plurality of events corresponding to a first event type.   
     
     
         5 . The method of  claim 1 , further comprising:
 generating the activity baseline based on runtime data from a plurality of workloads, each workload deployed based on a common code object.   
     
     
         6 . The method of  claim 5 , wherein the common code object is a software image. 
     
     
         7 . The method of  claim 1 , further comprising:
 removing a data point from the activity baseline based on an eviction policy.   
     
     
         8 . The method of  claim 1 , further comprising:
 detecting a plurality of processes by the runtime sensor on the workload; and   generating a unique activity baseline for each detected process.   
     
     
         9 . The method of  claim 1 , further comprising:
 generating the activity baseline further based on detected events in the cloud log.   
     
     
         10 . A non-transitory computer-readable medium storing a set of instructions for detecting cloud identity misuse in a cloud computing environment, the set of instructions comprising:
 one or more instructions that, when executed by one or more processors of a device, cause the device to:
 deploy a runtime sensor on a workload in a cloud computing environment; 
 receive event data from the runtime sensor; 
 detect an identifier of a runtime process in the received event data; 
 generate an activity baseline for the runtime process based at least on the received event data, wherein the runtime sensor is configured to detect a plurality of runtime process identifiers on the workload; 
 detect an event in a cloud log, the event including an identifier of the workload; 
 associate the runtime process detected by the runtime sensor on the workload with the event detected in the cloud log based at least on the identifier of the workload; and 
 determine that the event detected in the cloud log is an anomalous event based on the generated activity baseline of the runtime process. 
   
     
     
         11 . A system for detecting cloud identity misuse in a cloud computing environment comprising:
 a processing circuitry;   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:   deploy a runtime sensor on a workload in a cloud computing environment;   receive event data from the runtime sensor;   detect an identifier of a runtime process in the received event data;   generate an activity baseline for the runtime process based at least on the received event data, wherein the runtime sensor is configured to detect a plurality of runtime process identifiers on the workload;   detect an event in a cloud log, the event including an identifier of the workload;   associate the runtime process detected by the runtime sensor on the workload with the event detected in the cloud log based at least on the identifier of the workload; and   determine that the event detected in the cloud log is an anomalous event based on the generated activity baseline of the runtime process.   
     
     
         12 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 detect a code object utilized to deploy the workload in the cloud computing environment;   inspect the code object for a cybersecurity object, wherein the cybersecurity object indicates an identity utilized by the workload; and   associate the runtime process with the event based on an identifier of the workload and the indicated identity.   
     
     
         13 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the activity baseline based on a plurality of events detected in the received event data.   
     
     
         14 . The system of  claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the activity baseline based only on a group of events of the plurality of events corresponding to a first event type.   
     
     
         15 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the activity baseline based on runtime data from a plurality of workloads, each workload deployed based on a common code object.   
     
     
         16 . The system of  claim 15 , wherein the common code object is a software image. 
     
     
         17 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 remove a data point from the activity baseline based on an eviction policy.   
     
     
         18 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 detect a plurality of processes by the runtime sensor on the workload; and   generate a unique activity baseline for each detected process.   
     
     
         19 . The system of  claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the activity baseline further based on detected events in the cloud log.